---
title: "Policy Overrides"
method: POST
path: "/api/3/policy_overrides"
tags: ["Policy Override"]
---

# Policy Overrides

`POST /api/3/policy_overrides`

Submit a policy override. The policy override can be submitted or it can be submitted and approved in a single request.

## Request body

- PolicyOverride — The specification of a policy override. Allows users to override the compliance result of a policy rule.
  - `expires` string, date-time — The date the policy override is set to expire. Date is represented in ISO 8601 format.
  - `id` object — The identifier of the policy override.
  - `links` Link[], required — Hypermedia links to corresponding or related resources.
    - `deprecation` string
    - `href` string — A hypertext reference, which is either a URI (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc3986">RFC 3986</a>) or URI template (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc6570">RFC 6570</a>).
    - `hreflang` string
    - `media` string
    - `rel` string — The link relation type. This value is one from the <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc5988#section-6.2">Link Relation Type Registry</a> or is the type of resource being linked to.
    - `title` string
    - `type` string
  - `review` PolicyOverrideReviewer — Details regarding the review and/or approval of the policy override.
    - `comment` string — A comment from the reviewer detailing the review. Cannot exceed 1024 characters.
    - `date` string, date-time — The date the review took place.
    - `links` Link[], required — Hypermedia links to corresponding or related resources.
      - `deprecation` string
      - `href` string — A hypertext reference, which is either a URI (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc3986">RFC 3986</a>) or URI template (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc6570">RFC 6570</a>).
      - `hreflang` string
      - `media` string
      - `rel` string — The link relation type. This value is one from the <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc5988#section-6.2">Link Relation Type Registry</a> or is the type of resource being linked to.
      - `title` string
      - `type` string
    - `name` string — The identifier of the user that reviewed the policy override.
    - `user` object — The identifier of the user.
  - `scope` PolicyOverrideScope, required — The scope of the policy override. Indicates which assets' policy compliance results are to be affected by the override.
    - `asset` object — The identifier of the asset.
    - `links` Link[], required — Hypermedia links to corresponding or related resources.
      - `deprecation` string
      - `href` string — A hypertext reference, which is either a URI (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc3986">RFC 3986</a>) or URI template (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc6570">RFC 6570</a>).
      - `hreflang` string
      - `media` string
      - `rel` string — The link relation type. This value is one from the <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc5988#section-6.2">Link Relation Type Registry</a> or is the type of resource being linked to.
      - `title` string
      - `type` string
    - `newResult` 'pass' | 'fail' | 'not-applicable' | 'fixed', required — The new policy rule result after the override is applied.
    - `originalResult` 'pass' | 'fail' | 'error' | 'unknown' | 'not-applicable' | 'not-checked' | 'not-selected' | 'informational' | 'fixed' — The original policy rule result before the override was applied. This property only applies to overrides with a scope of either `"specific-asset"` or `"specific-asset-until-next-scan"`.
    - `rule` object, required — The identifier of the policy rule.
    - `type` 'all-assets' | 'specific-asset' | 'specific-asset-until-next-scan', required — The scope of assets affected by the policy override. Can be one of the following values: | Value | Description | | ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | `"all-assets"` | Overrides the compliance result of all assets evaluated with the specified policy rule. | | `"specific-asset"` | Overrides the compliance result of a single asset evaluated with the specified policy rule. | | `"specific-asset-until-next-scan"` | Overrides the compliance result of a single asset evaluated with the specified policy rule until the next time asset is evaluated against that policy rule. |
  - `state` 'under-review' | 'approved' | 'rejected' | 'deleted' | 'expired', required — The state of the policy override. Can be one of the following values: | Value | Description | Affects Compliance Results | | ---------------- | ----------------------------------------------------------------------------------- |:--------------------------:| | `"deleted"` | The policy override has been deleted. | | | `"expired"` | The policy override had an expiration date and it has expired. | | | `"approved"` | The policy override was submitted and approved. | &check; | | `"rejected"` | The policy override was rejected by the reviewer. | | | `"under-review"` | The policy override was submitted but not yet approved or rejected by the reviewer. | |
  - `submit` PolicyOverrideSubmitter, required — Details regarding the submission of the policy override.
    - `comment` string, required — A comment from the submitter as to why the policy override was submitted. Cannot exceed 1024 characters.
    - `date` string, date-time — The date the policy override was submitted.
    - `links` Link[], required — Hypermedia links to corresponding or related resources.
      - `deprecation` string
      - `href` string — A hypertext reference, which is either a URI (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc3986">RFC 3986</a>) or URI template (see <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc6570">RFC 6570</a>).
      - `hreflang` string
      - `media` string
      - `rel` string — The link relation type. This value is one from the <a target="_blank" rel="noopener noreferrer" href="https://tools.ietf.org/html/rfc5988#section-6.2">Link Relation Type Registry</a> or is the type of resource being linked to.
      - `title` string
      - `type` string
    - `name` string — The login name of the user that submitted the policy override.
    - `user` object — The identifier of the user.

## Response `200`

OK

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `500` — Internal Server Error
- `503` — Service Unavailable

---

[API](https://skmtc.net/rapid7/apis/rapid7-vm-api.md) · [All operations](https://skmtc.net/rapid7/apis/rapid7-vm-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/rapid7/rapid7-vm-api/revisions/3a8197c22d71/schema)